GrapheneOS fixes Android VPN leak Google refused to patch

148

GGeorgelemental about 5 hours ago 43 commentsRead Article on cyberinsider.com

⚡ Community Insights

Discussion Sentiment

33% Positive

Analyzed from 927 words in the discussion.

Discussion (43 Comments)Read Original on HackerNews

fg137•37 minutes ago

Side question: what's a good way of getting a GrapheneOS phone?

I have been interested in using GrapheneOS but hesitant about actually getting a Pixel phone. Used phone prices are usually >$300 even for "a" series unless I go back several generations. Whether the device bootloader can be unlocked is also a question. I am definitely not ready to spend $449 on a new Pixel 10a.

neilv•1 minute ago

I answered this in another thread: https://news.ycombinator.com/item?id=48076522

Basically, buy a Pixel 7 or later that you are sure has an unlockable bootloader.

Which mostly means either buy direct from Google, or buy one on eBay that already has GrapheneOS/CalyxOS on it, or for which the seller expressly says it has an unlockable bootloader.

(IME, don't bother trying to ask a seller to check, if they haven't already said. Almost no one is going to go through the process to check, the answer is probably no anyway, they might misunderstand your question and answer that it's "unlocked", and they may be tired of people asking.)

mpol•33 minutes ago

You could wait it out for a bit. There is work underway to support more phone hardware. Which brand was a bit up for speculation.

Itoldmyselfso•18 minutes ago

It was announced a while ago to be Mororola: https://motorolanews.com/motorola-three-new-b2b-solutions-at...

mystifyingpoi•24 minutes ago

Don't buy Pixel 10a, 9a is almost exactly the same thing and still sold new.

mctt•31 minutes ago

I bought a Pixel 7 from BackMarket to test out GrapheneOS. I have previous positive comments and conversations in my account history.

nottorp•about 3 hours ago

> Because system_server operates with elevated networking privileges and is exempt from VPN routing restrictions

So a VPN isn't a VPN on Android? Regardless of this bug. Do other locked down operating systems act the same?

Paradigm2020•about 2 hours ago

Ios does the same, only way around it is if you have an ?enterprise? licence (250+ devices)

Mullvad and others reported on that one ages ago

kqp•about 1 hour ago

Is this really true? The Mullvad report a year or so ago was that they didn’t want to turn on no exceptions mode because it breaks network connectivity until reboot if you don’t pause it when updating the app, not that the feature doesn’t exist. They also recently shipped it anyway, opt in and behind a warning.

ncr100•about 1 hour ago

Terminology like "private" and "trust" differ in meaning from computer land to human convention.

It's a concern to me, because humans often extend their trust to computer trust based upon misunderstanding of the identically spelled words and lack of recognition of differing context.

unethical_ban•about 2 hours ago

MacOS has had instances where their own apps could bypass always-on VPN. I'm not sure if there have been exploits or gaps where traffic could go to arbitrary destinations directly.

spr-alex•about 2 hours ago

this is not an ocassional bug this is still the system design today. privacy gateways upstream of big tech are the way to go on this because privacy isn't their profit center

mmooss•about 2 hours ago

How hard would it be to fix the system_server (and any other) bypass?

hedora•about 1 hour ago

> Google maintained its position, authorizing public disclosure on April 29.

I'm surprised they honored the embargo at that point, and delayed the fix until May. Why not just release immediately?

c0balt•about 1 hour ago

Not damaging their relationship with Google as a vendor most likely. For better or worse, GrapheneOS is depend on Android which is controlled by Google.

Georgelemental•about 1 hour ago

The researcher who discovered the bug is not affiliated with Graphene

zb3•about 2 hours ago

Stock Android is spyware and adware, back in the day we called such software malicious and removed it, now it's the default.

whatsupdog•about 1 hour ago

We all agree. But what's the solution? We know 99% of the users don't care. So, the only pressure point is phone manufacturers. I don't have any power to influence anybody significant in this space. I feel helpless.

unethical_ban•about 3 hours ago

I know there are bad business reasons, but how can someone classify a VPN leak as "not a security issue" and keep their pride?

boje•about 3 hours ago

That assumes there is pride they have to bother to keep.

k4rli•about 3 hours ago

Interestingly GrapheneOS being so good brings more money to Google as only Pixel phones are supported.

snapplebobapple•about 2 hours ago

First motorola grapheneos phone i am buying to get fully off the google pain train. Grapheneos tides me over until a real linux smart phone shows up or i die of old age. Now if home assistant could get thread network join*ng working without an android phone with a google account i could ve fully ris of those eh holes.

mcraiha•about 3 hours ago

There should be at least one Motorola phone before end of the year that has GrapheneOS support.

winter_blue•about 2 hours ago

Sadly, Verizon Pixel phones, even after carrier unlocking, seem to be forever blocked from using GrapheneOS.

oceansky•about 3 hours ago

So far. Other companies surely will make their devices compatible if the market share increases for it

DANmode•about 1 hour ago

I’ve seen this repeated here, but:

Google's Pixel hardware division likely operates at a loss - or breaks even.

and even if every active HN user bought $100-$400 used Pixels from Swappa, meaningless money to them.

zb3•about 2 hours ago

I don't see a problem with supporting their legitimate hardware or cloud business models. But of course I see a problem supporting their illegitimate adware and spyware business models.

SV_BubbleTime•about 1 hour ago

We need to bring back shame.

Step one… completely reform MBA programs.

helterskelter•about 1 hour ago

They're paid not to.

bflesch•about 2 hours ago

At some point digital security turns into physical security, and there are national security interests that have fine-tuned their detection logic on these kinds of "buggy" behavior.

If you patch it, you'd need to find another way to de-anonymize those users.

hedora•about 2 hours ago

So, somewhere, some government or organization might want to blow the user into kibble, and that's an important use case?

I feel like this should be toward the top of the terms of service for the phone, even above the mandatory arbitration clause.

like_any_other•about 2 hours ago

How can someone consider unwanted disclosure of personal information a security issue, and work at Google?

rexpop•about 2 hours ago

Corporations have no pride. They are soulless, psychopathic accountability sinks.

What planet are you from?

ignoramous•44 minutes ago

The issue reported on lowlevel.fun [0] and discussed on GrapheneOS forums [1] does seem like a security issue. It isn't clear why engineers in charge would mark it infeasible as the breach demonstrates more than one failure.

1. A new (albeit "hidden" [2]) network API registerQuicConnectionClosePayload(fd, payload) lets a process set any byte array for the OS to send on its behalf.

2. No ("panaroid networking") permission checks against the calling uid/process when sending that byte array out on a OS-owned UDP socket.

3. Bypassing ("panaroid android") permission checks [3] by simply calling network-related syscalls (or libc/bionic functions) as opposed to Android SDK APIs.

These steps essentially amount to app sandbox escape (2,3) and privilege escalation (1,2). I am utterly confused why the Android security team at Google won't take this more seriously.

[0] https://lowlevel.fun/posts/tiny-udp-cannon-android-vpn-bypas...

[1] https://discuss.grapheneos.org/d/35152-android-always-on-vpn...

[2] In as much the code mmap'd into your own process can be "hidden" away. For their exploit though, the author cleverly abuses Binder IPC primitives to reach the "hidden" parts.

[3] This bypass probably only works for this one scenario because of #2.

OutOfHere•about 3 hours ago

It wasn't patched by Google because it's a backdoor. For various reasons, modern mainline Android is substantially hazardous to use.